virtio_net: fix use after free on allocation failure
authorMichael S. Tsirkin <mst@redhat.com>
Tue, 14 Oct 2014 23:52:31 +0000 (10:22 +1030)
committerRusty Russell <rusty@rustcorp.com.au>
Tue, 14 Oct 2014 23:55:05 +0000 (10:25 +1030)
In the extremely unlikely event that driver initialization fails after
RX buffers are added, virtio net frees RX buffers while VQs are
still active, potentially causing device to use a freed buffer.

To fix, reset device first - same as we do on device removal.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
drivers/net/virtio_net.c

index aba7b93286b3f243e925be66e3abdef0d970a3da..53031e58a5fc13c6c43b0e4355620c35c110c56c 100644 (file)
@@ -1830,6 +1830,8 @@ static int virtnet_probe(struct virtio_device *vdev)
        return 0;
 
 free_recv_bufs:
+       vi->vdev->config->reset(vdev);
+
        free_receive_bufs(vi);
        unregister_netdev(dev);
 free_vqs: